On 05/08/2019 12:56, John Horne wrote:
Hello,
I was looking at a process through the '/proc' file system, and came across a process name which seemed to contain a hex value:
lrwxrwxrwx. 1 xymon xymon 0 Aug 2 14:07 /proc/58032/exe -> /usr/sbin/xymond;5d44410e (deleted)
I am aware of what the 'deleted' part means, but have no idea what the ';5d44410e' part means. Is this some sort of thread reference? The file '/usr/sbin/xymond' does exist and is running as a daemon.
Anyone know what the ';5d44410e' is referring to? I have tried Googling about this, but found no mention of it.
I am not absolutely sure, but is it saying that /usr/sbin/xymond was deleted, but was located at that inode reference on the disk?
I know you say it exists, but perhaps it was deleted since running and then re-created? or perhaps it is an self-modifying executable?